bugtraq - Re[2]: Lot of SQL injection on PHP-Nuke 6.5 (secure weblog!)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3717736283.20030514145728@hnc.cc>
Date: Wed, 14 May 2003 14:57:28 +0200
From: Benjamin Schulz <lists@....cc>
To: bugtraq@...urityfocus.com
Subject: Re[2]: Lot of SQL injection on PHP-Nuke 6.5 (secure weblog!)


Hi Rynho,

> if(!isset($cid) || $cid == NULL || $cid == "" || !is_numeric ($cid))
> {
>     echo "I don't like you >:|";
>     exit();
> }

you know that $cid == NULL equals $cid == ""? (int)0, too btw.
either check $cid == '' (what is 0 & NULL, too)
or $cid === NULL || $cid === '',
or empty($cid)

Mit freundlichen Gruessen / Kind regards
-- 
Benjamin Schulz

There are 10 types of people: those who understand binary and
those who don't.